Comments

@czigor there are a lot of things that could cause shielding to not work properly, especially if you're just setting things up. Commonly, there may be a return(deliver); or return(pass); statement in your compiled VCL before the shielding logic executes.

I start all my vcl subs with the #FASTLY include. E.g.
sub vcl_recv {
#FASTLY recv
// My logic comes here.
}
So I guess this should not be a problem. Strangely we still get a surprisingly high hit rate, although the X-Served-By seems to change a lot. Will look into this further.

It might be important to note that for logged-out users we see X-Served-By headers containing two nodes (as it should). (In this case our vcl logic more or less simplifies down to the one of Fastly's.) There's always one node in X-Served-By when the user is logged in.

There are things that can be set in the UI that will bypass shielding, so there may be problems there. It's hard to tell without looking at your service directly. If you'd like, send us an email at support@fastly.com and we'll take a look.